7 matches found
CVE-2026-3835
The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in the getadvancefilebyurl method in all versions up to, and including, 2.8.8.8 The method uses a SQL LIKE operator for token looku...
CVE-2026-3835 Prevent Direct Access – Protect WordPress Files <= 2.8.8.8 - Unauthenticated Protected File Access
The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in the getadvancefilebyurl method in all versions up to, and including, 2.8.8.8 The method uses a SQL LIKE operator for token looku...
CVE-2026-3835
The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in the getadvancefilebyurl method in all versions up to, and including, 2.8.8.8 The method uses a SQL LIKE operator for token looku...
EUVD-2026-57720
The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in the getadvancefilebyurl method in all versions up to, and including, 2.8.8.8 The method uses a SQL LIKE operator for token looku...
CVE-2026-3835
The CVE covers the WordPress plugin Prevent Direct Access – Protect WordPress Files. All versions up to 2.8.8.8 are affected due to insufficient token validation in get_advance_file_by_url(), which uses a SQL LIKE without escaping wildcards via $wpdb->esc_like(). This allows unauthenticated us...
CVE-2026-3835 Prevent Direct Access – Protect WordPress Files <= 2.8.8.8 - Unauthenticated Protected File Access
The Prevent Direct Access – Protect WordPress Files plugin for WordPress is vulnerable to unauthorized access of protected files due to insufficient token validation in the getadvancefilebyurl method in all versions up to, and including, 2.8.8.8 The method uses a SQL LIKE operator for token looku...
CVE-2026-25591 New API has an SQL LIKE Wildcard Injection DoS via Token Search
New API is a large language mode LLM gateway and artificial intelligence AI asset management system. Prior to version 0.10.8-alpha.10, a SQL LIKE wildcard injection vulnerability in the /api/token/search endpoint allows authenticated users to cause denial of service through resource exhaustion by...